Privacy Policy

INFORMATION NOTICE PURSUANT TO ARTICLE 13 OF REGULATION (EU) NO. 2016/679

Dear User,

Current legislation requires that information be provided regarding the processing of personal data for this website. This Privacy Policy is therefore provided to all users who interact with the Website and its related services.

1. Data Controller

   1. The Data Controller is TARTUFLANGHE S.R.L., with registered office at Loc. Catena Rossa, 7 – 12040 Piobesi d’Alba (CN), Italy, Tax Code/VAT number 03062420041, which can be contacted at the following email address: privacy@tartuflanghe.com.
   2. Pursuant to applicable legislation, the User is the data subject.

2. Categories of Data Processed

   1. Browsing data: The information systems and software procedures used to operate this website collect certain personal data whose transmission is implicit in the use of Internet communication protocols (such as IP addresses or domain names of the computers used by users connecting to the site, URI addresses of requested resources, time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the response provided by the server – successful, error, etc. – and other parameters relating to the user’s operating system and IT environment).
      Although this information is not collected in order to be associated with identified data subjects, it may, by its very nature and through processing and association with data held by third parties, allow users to be identified.

Such data are processed, for the time strictly necessary under applicable law, solely for the purpose of obtaining anonymous statistical information on the use of the website and to monitor its proper functioning. Such data may also be used to ascertain liability in the event of computer-related crimes against the Website or other connected or linked websites.

Cookies: This Website makes use of cookies. For further information and to consult the detailed cookie notice, the User may refer to the Cookie Policy available on the website.

During interactions through the Website, the User may be required to provide personal data, in particular:

• data entered by the User when completing contact forms for “bookings” (name, email address, phone number, and details of the requested booking);
• the email address entered by the User for possible subscription to the newsletter;
• data entered by the User when purchasing products through the e-commerce section. The required data include personal and invoicing information (name, company name, VAT number/tax code, shipping address, billing address, telephone number, email address), as well as payment and transaction data, as specified in the relevant section;
• data for registration to the User’s reserved area through the creation of personal credentials;
• any additional and further contact with the Data Controller, for example to request information about a service through the voluntary sending of messages, emails or traditional mail to the Data Controller’s contact details, which entails the subsequent acquisition of the sender’s personal data necessary to respond to the request, as well as any other data voluntarily included in the communication.

3. Purposes of Processing and Legal Bases

   1. The personal data voluntarily provided by the User will be processed for the following purposes:

1. to ensure technical and functional access to the website, guarantee the correct functioning of web pages and their contents, and process anonymous statistical and analytical information regarding website navigation. Monitoring and security activities may also allow the identification of liability in the event of cybercrime to the detriment of the website and to assert or defend a right in court;
2. to respond to requests for information or commercial requests during the pre-contractual phase;
3. to provide the requested service or performance, process purchases made through the e-commerce section, and fulfill contractual obligations undertaken by the Data Controller, both in terms of order fulfillment and administrative management. Data are therefore used to ensure a secure payment and purchasing experience, to identify, investigate or act against fraudulent, illegal, unsafe or harmful activities, and to protect the services;
4. to allow User registration on the website and access to purchase data and personal data. Users registering in the reserved area are responsible for protecting their login credentials;
5. to comply with administrative, tax and accounting obligations in order to manage the commercial relationship with you or your organization, manage payments related to e-commerce purchases, bookkeeping, invoicing and related customer support services;
6. to comply with any legal obligation and/or order of a Public Authority;
7. subject to your consent, to send newsletters and/or informational, commercial and/or promotional communications concerning products, news, promotions and events promoted by Tartuflanghe S.R.L. The data subject may revoke consent at any time, without prejudice to data communications to third parties required by law, the absence of which could partially or entirely compromise the provision of services or the handling of received requests.
   1. Processing referred to in point a) is based on the Data Controller’s legitimate interest in ensuring the best possible browsing experience on the Website (Article 6(1)(f) GDPR).
   2. Processing referred to in points b–c–d is carried out in order to implement pre-contractual measures requested by the User and/or to perform contractual measures by Data Controller (Article 6(1)(b) GDPR).
   3. Processing referred to in points e–f is necessary to comply with legal obligations incumbent upon the Data Controller (Article 6(1)(c) GDPR).
   4. Processing referred to in point g) is based on the User’s consent (Article 6(1)(a) GDPR).

4. Processing Methods

   1. Personal data will be:

• collected by electronic means;
• recorded in digital format on computers and/or stored in archives;
• protected against risks of destruction, alteration, deletion and unauthorized access through appropriate physical, logical and organizational security measures;
• further processed, where necessary also in paper form, within the limits and for the time strictly necessary to achieve the purposes indicated above.
  1. The Data Controller may make use of services provided by third parties acting on behalf of and under the instructions of the Data Controller, as Data Processors, as specified below.

5. Data Disclosure and Communication

   1. Personal data are not disclosed but may be communicated to parties contractually bound to the Data Controller, in compliance with and within the limits of the GDPR. Data are communicated only to the extent strictly necessary for the purposes described above, for service provision, to comply with legal obligations or by order of an Authority. Recipients include:

1. authorized persons and employees of the Data Controller who are bound by confidentiality obligations;
2. parties necessary for the performance of the requested service, acting as Data Processors on behalf of Data Controller pursuant to Article 28 GDPR, including:
   • service providers for website and e-commerce management, assistance and updates, IT service providers managing the information systems and telecommunications networks, including email services;
   • Shopify, for e-commerce platform management, which may use subcontractors for the provision of services necessary for platform operation. More information on Shopify’s data processing practices is available at the following link: https://privacy.shopify.com/en;
   • providers for administrative, tax and accounting compliance (e.g. accountants);
3. online payment service providers and providers responsible for delivery and shipping services.

6. Data Transfers

   1. Personal data collected through this website are processed primarily within the European Economic Area (EEA). However, in relation to specific services offered through the e-commerce platform, Users’ personal data may be transferred to countries outside the European Union or the EEA (e.g. Shopify platform, potential transfers to third countries such as Canada).
      In such cases, lawfulness of the transfer is ensured on the basis of an adequacy decision of the European Commission pursuant to Article 45 GDPR or through Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention Period

   1. The Data Controller retains personal data for the time strictly necessary to achieve the purposes outlined above.
   2. Personal data relating to e-commerce purchases are retained in accordance with applicable tax and accounting laws (10 years from acquisition).
   3. Data collected through contact forms for bookings are retained only for the time necessary to address the User’s request and depending on how the commercial relationship develops.
   4. The newsletter service is ongoing; by providing consent, the User subscribes to a recurring service, the frequency of which may vary. Data are retained for 24 months, unless consent is withdrawn earlier.

8. Nature of Data Provision

   1. Except for browsing data, the provision of personal data by the data subject for the purposes described above is voluntary. However, refusal to provide personal data may make it impossible to access certain services offered by the Website.
   2. In particular, for the purchase of products through the e-commerce area, the data subject cannot refuse to provide to Data Controller the personal data required to comply with legal provisions governing commercial transactions and taxation. Failure to provide such mandatory data will prevent the completion of the purchase.
   3. Failure to complete the contact forms will prevent the submission of User requests.
   4. Subscription to the newsletter is optional. Failure to subscribe will not allow receipt of such communications.

9. Data Subject Rights

   1. Pursuant to the GDPR, the data subject may exercise the following rights:

1. Right of access (Article 15): to contact the Data Controller to access personal data and request amendments;
2. Right to rectification (Article 16): to request the Data Controller correction or updating of data;
3. Right to erasure (Article 17): to request the Data Controller deletion of personal data;
4. Right to restriction of processing: to request the Data Controller suspension of processing where legitimate grounds exist;
5. Right to data portability (Article 20): to receive personal data in a structured format and transfer them to third parties;
6. Right to object (Articles 21): to object at any time to specific uses of data carried out by the Data Controller (e.g. newsletters, automated emails).
   1. To exercise these rights, the data subject may contact the Data Controller by specifying the subject of the request and the right to be exercised, at the following address:

TARTUFLANGHE S.R.L., Loc. Catena Rossa, 7 – 12040 Piobesi d’Alba (CN), Italy,
or via email at: privacy@tartuflanghe.com.

10. Automated Decision-Making Processes

    1. The Data Controller does not carry out processing involving automated decision-making, including profiling.

11. Social Media Links

    1. With regard to social media links: Facebook provides Page Insights, a feature offering aggregated data that help understand how users interact with Facebook Pages.
       For the Facebook Page managed by Tartuflanghe S.R.L., the Company acts as Joint Data Controller of statistical data together with Meta Platforms. The Page Controller Addendum specifying the allocation of responsibilities is available at:

https://www.facebook.com/legal/terms/page_controller_addendum

Meta Platforms’ data policy is available at:
https://www.facebook.com/privacy/explanation

Meta Platforms’ cookie policy is available at:
https://www.facebook.com/policies/cookies

For further information on Instagram’s terms of use, users may consult:
https://help.instagram.com/581066165581870

12. Amendments to this Privacy Policy

    1. The Data Controller reserves the right to amend this Privacy Policy, in whole or in part, including as a result of changes in privacy legislation.
    2. The updated version will be published on the Website and will be binding from that moment; Users are therefore encouraged to review this section regularly.

Last updated: 20 /04/2026